5. Distribution of information
At times OxCERT will need to share information with others, for instance as part of an ongoing investigation. The aim will be at all times to respect users' privacy and to disclose no more personal data than is necessary for proper and prompt investigation of the incident in hand. In most cases, the data will be shared within the University, for instance with a user's local IT support staff or with the OUCS helpdesk.
In certain circumstances it may be necessary to share data with University disciplinary authorities; this will be done upon request of the appropriate University official and with the knowledge of at least one senior manager at OUCS.
In reporting specific instances of abuse to an external third party it may be necessary to include a limited amount of personally-identifying information in order that the particular instance of abuse can be traced. For example, a local IP address may be specified as receiving malicious network traffic, or a spam report to another university may include sufficient information to determine the local recipient; omitting such information would merely make it difficult or impossible for the third-party to trace the origin of the problem.
Anonymised and accumulated data (for instance, details of overall network traffic volumes, number of incidents handled) may be made available without restrictions, since no personally-identifying information is being disclosed.